disas/capstone.c

   1 /*
   2  * Interface to the capstone disassembler.
   3  * SPDX-License-Identifier: GPL-2.0-or-later
   4  */
   5
   6 #include "qemu/osdep.h"
   7 #include "qemu/bswap.h"
   8 #include "disas/dis-asm.h"
   9 #include "disas/capstone.h"
  10
  11
  12 /*
  13  * Temporary storage for the capstone library.  This will be alloced via
  14  * malloc with a size private to the library; thus there's no reason not
  15  * to share this across calls and across host vs target disassembly.
  16  */
  17 static __thread cs_insn *cap_insn;
  18
  19 /*
  20  * The capstone library always skips 2 bytes for S390X.
  21  * This is less than ideal, since we can tell from the first two bits
  22  * the size of the insn and thus stay in sync with the insn stream.
  23  */
  24 static size_t CAPSTONE_API
  25 cap_skipdata_s390x_cb(const uint8_t *code, size_t code_size,
  26                       size_t offset, void *user_data)
  27 {
  28     size_t ilen;
  29
  30     /* See get_ilen() in target/s390x/internal.h.  */
  31     switch (code[offset] >> 6) {
  32     case 0:
  33         ilen = 2;
  34         break;
  35     case 1:
  36     case 2:
  37         ilen = 4;
  38         break;
  39     default:
  40         ilen = 6;
  41         break;
  42     }
  43
  44     return ilen;
  45 }
  46
  47 static const cs_opt_skipdata cap_skipdata_s390x = {
  48     .mnemonic = ".byte",
  49     .callback = cap_skipdata_s390x_cb
  50 };
  51
  52 /*
  53  * Initialize the Capstone library.
  54  *
  55  * ??? It would be nice to cache this.  We would need one handle for the
  56  * host and one for the target.  For most targets we can reset specific
  57  * parameters via cs_option(CS_OPT_MODE, new_mode), but we cannot change
  58  * CS_ARCH_* in this way.  Thus we would need to be able to close and
  59  * re-open the target handle with a different arch for the target in order
  60  * to handle AArch64 vs AArch32 mode switching.
  61  */
  62 static cs_err cap_disas_start(disassemble_info *info, csh *handle)
  63 {
  64     cs_mode cap_mode = info->cap_mode;
  65     cs_err err;
  66
  67     cap_mode += (info->endian == BFD_ENDIAN_BIG ? CS_MODE_BIG_ENDIAN
  68                  : CS_MODE_LITTLE_ENDIAN);
  69
  70     err = cs_open(info->cap_arch, cap_mode, handle);
  71     if (err != CS_ERR_OK) {
  72         return err;
  73     }
  74
  75     /* "Disassemble" unknown insns as ".byte W,X,Y,Z".  */
  76     cs_option(*handle, CS_OPT_SKIPDATA, CS_OPT_ON);
  77
  78     switch (info->cap_arch) {
  79     case CS_ARCH_SYSZ:
  80         cs_option(*handle, CS_OPT_SKIPDATA_SETUP,
  81                   (uintptr_t)&cap_skipdata_s390x);
  82         break;
  83
  84     case CS_ARCH_X86:
  85         /*
  86          * We don't care about errors (if for some reason the library
  87          * is compiled without AT&T syntax); the user will just have
  88          * to deal with the Intel syntax.
  89          */
  90         cs_option(*handle, CS_OPT_SYNTAX, CS_OPT_SYNTAX_ATT);
  91         break;
  92     }
  93
  94     /* Allocate temp space for cs_disasm_iter.  */
  95     if (cap_insn == NULL) {
  96         cap_insn = cs_malloc(*handle);
  97         if (cap_insn == NULL) {
  98             cs_close(handle);
  99             return CS_ERR_MEM;
 100         }
 101     }
 102     return CS_ERR_OK;
 103 }
 104
 105 static void cap_dump_insn_units(disassemble_info *info, cs_insn *insn,
 106                                 int i, int n)
 107 {
 108     fprintf_function print = info->fprintf_func;
 109     FILE *stream = info->stream;
 110
 111     switch (info->cap_insn_unit) {
 112     case 4:
 113         if (info->endian == BFD_ENDIAN_BIG) {
 114             for (; i < n; i += 4) {
 115                 print(stream, " %08x", ldl_be_p(insn->bytes + i));
 116
 117             }
 118         } else {
 119             for (; i < n; i += 4) {
 120                 print(stream, " %08x", ldl_le_p(insn->bytes + i));
 121             }
 122         }
 123         break;
 124
 125     case 2:
 126         if (info->endian == BFD_ENDIAN_BIG) {
 127             for (; i < n; i += 2) {
 128                 print(stream, " %04x", lduw_be_p(insn->bytes + i));
 129             }
 130         } else {
 131             for (; i < n; i += 2) {
 132                 print(stream, " %04x", lduw_le_p(insn->bytes + i));
 133             }
 134         }
 135         break;
 136
 137     default:
 138         for (; i < n; i++) {
 139             print(stream, " %02x", insn->bytes[i]);
 140         }
 141         break;
 142     }
 143 }
 144
 145 static void cap_dump_insn(disassemble_info *info, cs_insn *insn)
 146 {
 147     fprintf_function print = info->fprintf_func;
 148     FILE *stream = info->stream;
 149     int i, n, split;
 150
 151     print(stream, "0x%08" PRIx64 ": ", insn->address);
 152
 153     n = insn->size;
 154     split = info->cap_insn_split;
 155
 156     /* Dump the first SPLIT bytes of the instruction.  */
 157     cap_dump_insn_units(info, insn, 0, MIN(n, split));
 158
 159     /* Add padding up to SPLIT so that mnemonics line up.  */
 160     if (n < split) {
 161         int width = (split - n) / info->cap_insn_unit;
 162         width *= (2 * info->cap_insn_unit + 1);
 163         print(stream, "%*s", width, "");
 164     }
 165
 166     /* Print the actual instruction.  */
 167     print(stream, "  %-8s %s\n", insn->mnemonic, insn->op_str);
 168
 169     /* Dump any remaining part of the insn on subsequent lines.  */
 170     for (i = split; i < n; i += split) {
 171         print(stream, "0x%08" PRIx64 ": ", insn->address + i);
 172         cap_dump_insn_units(info, insn, i, MIN(n, i + split));
 173         print(stream, "\n");
 174     }
 175 }
 176
 177 /* Disassemble SIZE bytes at PC for the target.  */
 178 bool cap_disas_target(disassemble_info *info, uint64_t pc, size_t size)
 179 {
 180     uint8_t cap_buf[1024];
 181     csh handle;
 182     cs_insn *insn;
 183     size_t csize = 0;
 184
 185     if (cap_disas_start(info, &handle) != CS_ERR_OK) {
 186         return false;
 187     }
 188     insn = cap_insn;
 189
 190     while (1) {
 191         size_t tsize = MIN(sizeof(cap_buf) - csize, size);
 192         const uint8_t *cbuf = cap_buf;
 193
 194         if (info->read_memory_func(pc + csize, cap_buf + csize, tsize, info) == 0) {
 195             csize += tsize;
 196             size -= tsize;
 197
 198             while (cs_disasm_iter(handle, &cbuf, &csize, &pc, insn)) {
 199                 cap_dump_insn(info, insn);
 200             }
 201
 202             /* If the target memory is not consumed, go back for more... */
 203             if (size != 0) {
 204                 /*
 205                  * ... taking care to move any remaining fractional insn
 206                  * to the beginning of the buffer.
 207                  */
 208                 if (csize != 0) {
 209                     memmove(cap_buf, cbuf, csize);
 210                 }
 211                 continue;
 212             }
 213
 214             /*
 215              * Since the target memory is consumed, we should not have
 216              * a remaining fractional insn.
 217              */
 218             if (csize != 0) {
 219                 info->fprintf_func(info->stream,
 220                                    "Disassembler disagrees with translator "
 221                                    "over instruction decoding\n"
 222                                    "Please report this to qemu-devel@nongnu.org\n");
 223             }
 224             break;
 225
 226         } else {
 227             info->fprintf_func(info->stream,
 228                                "0x%08" PRIx64 ": unable to read memory\n", pc);
 229             break;
 230         }
 231     }
 232
 233     cs_close(&handle);
 234     return true;
 235 }
 236
 237 /* Disassemble SIZE bytes at CODE for the host.  */
 238 bool cap_disas_host(disassemble_info *info, const void *code, size_t size)
 239 {
 240     csh handle;
 241     const uint8_t *cbuf;
 242     cs_insn *insn;
 243     uint64_t pc;
 244
 245     if (cap_disas_start(info, &handle) != CS_ERR_OK) {
 246         return false;
 247     }
 248     insn = cap_insn;
 249
 250     cbuf = code;
 251     pc = (uintptr_t)code;
 252
 253     while (cs_disasm_iter(handle, &cbuf, &size, &pc, insn)) {
 254         cap_dump_insn(info, insn);
 255     }
 256     if (size != 0) {
 257         info->fprintf_func(info->stream,
 258             "Disassembler disagrees with TCG over instruction encoding\n"
 259             "Please report this to qemu-devel@nongnu.org\n");
 260     }
 261
 262     cs_close(&handle);
 263     return true;
 264 }
 265
 266 /* Disassemble COUNT insns at PC for the target.  */
 267 bool cap_disas_monitor(disassemble_info *info, uint64_t pc, int count)
 268 {
 269     uint8_t cap_buf[32];
 270     csh handle;
 271     cs_insn *insn;
 272     size_t csize = 0;
 273
 274     if (cap_disas_start(info, &handle) != CS_ERR_OK) {
 275         return false;
 276     }
 277     insn = cap_insn;
 278
 279     while (1) {
 280         /*
 281          * We want to read memory for one insn, but generically we do not
 282          * know how much memory that is.  We have a small buffer which is
 283          * known to be sufficient for all supported targets.  Try to not
 284          * read beyond the page, Just In Case.  For even more simplicity,
 285          * ignore the actual target page size and use a 1k boundary.  If
 286          * that turns out to be insufficient, we'll come back around the
 287          * loop and read more.
 288          */
 289         uint64_t epc = QEMU_ALIGN_UP(pc + csize + 1, 1024);
 290         size_t tsize = MIN(sizeof(cap_buf) - csize, epc - pc);
 291         const uint8_t *cbuf = cap_buf;
 292
 293         /* Make certain that we can make progress.  */
 294         assert(tsize != 0);
 295         if (info->read_memory_func(pc + csize, cap_buf + csize,
 296                                    tsize, info) == 0)
 297         {
 298             csize += tsize;
 299
 300             if (cs_disasm_iter(handle, &cbuf, &csize, &pc, insn)) {
 301                 cap_dump_insn(info, insn);
 302                 if (--count <= 0) {
 303                     break;
 304                 }
 305             }
 306             memmove(cap_buf, cbuf, csize);
 307         } else {
 308             info->fprintf_func(info->stream,
 309                                "0x%08" PRIx64 ": unable to read memory\n", pc);
 310             break;
 311         }
 312     }
 313
 314     cs_close(&handle);
 315     return true;
 316 }
 317
 318 /* Disassemble a single instruction directly into plugin output */
 319 bool cap_disas_plugin(disassemble_info *info, uint64_t pc, size_t size)
 320 {
 321     uint8_t cap_buf[32];
 322     const uint8_t *cbuf = cap_buf;
 323     csh handle;
 324
 325     if (cap_disas_start(info, &handle) != CS_ERR_OK) {
 326         return false;
 327     }
 328
 329     assert(size < sizeof(cap_buf));
 330     info->read_memory_func(pc, cap_buf, size, info);
 331
 332     if (cs_disasm_iter(handle, &cbuf, &size, &pc, cap_insn)) {
 333         info->fprintf_func(info->stream, "%s %s",
 334                            cap_insn->mnemonic, cap_insn->op_str);
 335     }
 336
 337     cs_close(&handle);
 338     return true;
 339 }